Here is even a better approach.
Create 2 list/libraries, Use workflow to copy from submitted location to secure location and delete original. Therefore you do not get into unique permissions at the item level, which is not a good practice.